synthetic-data-toolkit
Umbrella for the synthetic test data generators beyond plain Faker - FactoryBot (Ruby factories with traits, associations, and build / create / build_stubbed strategies), Mimesis (fast type-hinted Python generator with the Schema/Field bulk pattern and 46 locales), and Bogus (.NET typed `Faker<T>` builders with `.RuleFor` / `StrictMode` / `UseSeed`). Picks the right generator by language and job, shows side-by-side equivalents of the same fixture across all four ecosystems, and carries each tool's full workflow in references/ (factory-bot.md, mimesis.md, bogus.md). faker-data stays the default for plain field values in Python / JS / Ruby; use this skill when the project needs typed factory orchestration, .NET fixtures, or a documented "which tool should I use" decision.
Install with skills.sh (any agent)
npx skills add testland/qa --skill synthetic-data-toolkitsynthetic-data-toolkit
Overview
Synthetic-data generation has the same conceptual job in every language: produce realistic field values, optionally compose them into typed object graphs. But the canonical library differs per language. This umbrella routes the team to the right one, shows side-by-side equivalents so a reviewer recognizes the patterns regardless of language, and carries the full per-tool workflows (install, authoring, seeding, anti-patterns) in references/.
When to use
If the project just needs plain field values in Python / JS / Ruby, defer to faker-data - the default of the family. The per-tool workflows this umbrella carries:
Dispatch by language
Project language?
├── Python
│ ├── Need typed-dict / schema-based bulk generation?
│ │ └── Yes → references/mimesis.md (faster + typed schema-Field pattern)
│ └── No → faker-data (Python `faker`, larger ecosystem)
├── JavaScript / TypeScript
│ ├── Browser or Node? → faker-data (`@faker-js/faker`)
│ └── Need factory orchestration with referential integrity?
│ └── Hand-rolled with Faker as the engine; no canonical factory library yet.
├── Ruby
│ ├── Need factory orchestration? → references/factory-bot.md (FactoryBot + Faker as engine)
│ └── Just values? → faker-data (`faker-ruby` gem)
├── .NET (C# / F# / VB.NET)
│ └── references/bogus.md (only canonical option in the ecosystem)
└── JVM (Java / Kotlin / Scala)
└── Multiple options (datafaker, easy-random, instancio); not covered here.Dispatch by job
| Job | Tool |
|---|---|
| Random field value (one name, one email) | Faker (any language) or mimesis (Python). |
| Typed-object factory with referential integrity | FactoryBot (Ruby) / Bogus (.NET) / hand-roll (Python+factory_boy, JS+fishery). |
| Locale-aware data (Japanese names, German addresses) | mimesis (Python; 46 locales) or Faker (any; 70+ locales). |
| Bulk generation (10k+ rows for DB seeding) | mimesis Schema/Field (Python) or Bogus GenerateLazy (.NET). |
| Realistic but deterministic (seed-driven for repro) | All four - every library supports a seed; pin the version. |
| Adversarial / security payloads | None of these - use malicious-payload-bank. |
| Realistic-but-fake PII for non-prod | synthetic-pii-generator (sibling skill that wraps Faker / mimesis). |
Per-tool workflow overview
Each tool's full workflow (install, authoring, test-framework integration, anti-patterns, limitations) lives in its reference page; the shape at a glance:
FactoryBot (Ruby) - references/factory-bot.md
The canonical Ruby fixture-factory library (factory_bot-readme (opens in new window)). Define one base factory per model, add trait blocks for variants, wire Faker into attribute blocks for values, and pick the weakest build strategy that still tests what you need (build_stubbed >> build >> create):
FactoryBot.define do
factory :user do
name { Faker::Name.name }
trait :admin do role { "admin" } end
end
end
user = create(:user, :admin)Mimesis (Python) - references/mimesis.md
Fast, type-hinted, 46-locale Python generator (mimesis-readme (opens in new window)). Use Generic for multi-provider fixtures and the Schema / Field pattern for typed-dict bulk generation (10k+ rows):
from mimesis import Generic, Locale
g = Generic(Locale.EN, seed=42)
user = {"name": g.person.full_name(), "email": g.person.email()}Bogus (.NET) - references/bogus.md
The canonical .NET generator (bogus-readme (opens in new window)): typed Faker<T> builders with fluent .RuleFor per property. Always use .StrictMode(true) (fails when a property lacks a rule) and UseSeed for reproducibility; GenerateLazy streams large batches:
var faker = new Faker<User>().StrictMode(true).UseSeed(42)
.RuleFor(u => u.Name, f => f.Name.FullName())
.RuleFor(u => u.Email, f => f.Internet.Email());
var user = faker.Generate();Side-by-side: same fixture in four languages
Generate a single user with name + email + a date of birth in [1980, 2000]. Canonical example (Python / Faker):
from faker import Faker
Faker.seed(42)
fake = Faker()
user = {
"name": fake.name(),
"email": fake.email(),
"dob": fake.date_of_birth(minimum_age=23, maximum_age=43),
}The pattern is identical across libraries; only the API style differs (method calls vs. RuleFor builders). The same fixture in mimesis, faker-js, FactoryBot, and Bogus: references/language-variants.md.
Cross-cutting concerns
Seeding
Every library supports a seed. The convention is:
Version pinning
All four libraries change their PRNG sequence across major versions. Pin the dependency version in CI; document the version in a seeding-conventions doc; revisit on intentional library bumps.
Per-test resetting
Reset the seed in per-test setup (beforeEach / autouse fixture) so each test starts with the same baseline:
| Language | Reset call |
|---|---|
| JS / TS (Jest / Vitest) | faker.seed(42) in beforeEach |
| Python (pytest) | Faker.seed(42) in an autouse fixture |
| Ruby (RSpec) | Faker::Config.random = Random.new(42) in before(:each) |
| .NET (xUnit) | new Faker<T>().UseSeed(42) per test |
Full reset snippets per language: references/language-variants.md.
When NOT to use synthetic data
| Scenario | Use this instead |
|---|---|
| Security testing (SQL injection / XSS) | malicious-payload-bank. |
| Production-shaped PII (real-looking SSN, credit card) | synthetic-pii-generator. |
| Boundary cases (off-by-one, type-min/max) | boundary-value-generator. |
| Negative-path coverage (error responses, malformed input) | negative-test-generator. |
| Persistent E2E seed sets | seed-data-curator. |
Faker / FactoryBot / mimesis / Bogus generate realistic-looking positive-path data. The related skills above handle the adversarial, boundary, and persistent cases.
References
Related skills
Bogus (.NET) - full workflow
View source (opens in new window)Bogus (.NET) - full workflow
Reference detail for synthetic-data-toolkit (opens in new window). Bogus is the canonical .NET test-data generator, ported from faker.js's spirit but typed for the C#-first ecosystem (bogus-readme (opens in new window)). It uses typed Faker<T> builders with fluent .RuleFor calls per property - the .NET equivalent of combining Faker's value generation with a factory library's referential integrity.
When to use
Install
Install-Package Bogus(Per bogus-readme (opens in new window); via NuGet.)
For .NET CLI:
dotnet add package BogusAuthoring
Typed faker builder
using Bogus;
public class User
{
public int Id { get; set; }
public string Name { get; set; }
public string Email { get; set; }
public DateTime CreatedAt { get; set; }
}
var faker = new Faker<User>()
.RuleFor(u => u.Id, f => f.IndexFaker)
.RuleFor(u => u.Name, f => f.Name.FullName())
.RuleFor(u => u.Email, f => f.Internet.Email())
.RuleFor(u => u.CreatedAt, f => f.Date.Past());(Adapted from bogus-readme (opens in new window).)
f is a Faker instance (lowercase) exposing the same data-set modules as the JS / Python ports: f.Name, f.Internet, f.Date, f.Commerce, f.Address, f.Lorem, f.Random, etc.
f.IndexFaker gives a sequential integer per generation - useful for IDs that must be unique within a test.
Strict mode (recommended)
var faker = new Faker<User>()
.StrictMode(true)
.RuleFor(u => u.Id, f => f.IndexFaker)
.RuleFor(u => u.Name, f => f.Name.FullName())
.RuleFor(u => u.Email, f => f.Internet.Email())
.RuleFor(u => u.CreatedAt, f => f.Date.Past());.StrictMode(true) causes Bogus to fail at runtime if any property of T lacks a RuleFor. Recommended - it prevents silent fixture drift when a model adds a new property and the factory isn't updated.
Computed and conditional rules
var faker = new Faker<User>()
.RuleFor(u => u.FirstName, f => f.Name.FirstName())
.RuleFor(u => u.LastName, f => f.Name.LastName())
.RuleFor(u => u.FullName, (f, u) => $"{u.FirstName} {u.LastName}") // computed from already-set fields
.RuleFor(u => u.IsActive, f => f.Random.Bool(0.9f)); // 90% activeThe second-argument-form of RuleFor ((f, u) => ...) lets a rule reference already-generated properties on the same instance - useful for derived fields.
Generation
Per bogus-readme (opens in new window):
| Method | Returns |
|---|---|
faker.Generate() | One T instance. |
faker.Generate(N) | List of N instances. |
faker.GenerateBetween(min, max) | Random count in [min, max]. |
faker.GenerateLazy(N) | Lazy enumerable - generates on iteration; saves memory for large N. |
var oneUser = faker.Generate(); // single
var hundred = faker.Generate(100); // list of 100
var lazyTen = faker.GenerateLazy(10); // IEnumerable<User>; deferredUse GenerateLazy when seeding a database with thousands of rows - it streams instead of materializing.
Seeding
var faker = new Faker<Order>()
.UseSeed(1338)
.RuleFor(o => o.Item, f => f.Commerce.Product());(Per bogus-readme (opens in new window).)
UseSeed(int) makes generation reproducible across runs - same seed produces same data. Mirror the faker-data seeding guidance: seed in test setup so failures reproduce.
For globally seeding the underlying randomizer (affecting any non-Faker<T> direct calls):
Randomizer.Seed = new Random(42);Locale support
var faker = new Faker<User>("de")
.RuleFor(u => u.Name, f => f.Name.FullName());The locale code in the constructor switches data sets. Bogus ships 30+ locales; supported codes match Faker's conventions (en, de, ja, ko, ru, pt_BR, etc.).
Test framework integration
xUnit
public class UserTests
{
private readonly Faker<User> _userFaker = new Faker<User>("en")
.UseSeed(42)
.StrictMode(true)
.RuleFor(u => u.Name, f => f.Name.FullName())
.RuleFor(u => u.Email, f => f.Internet.Email());
[Fact]
public void User_HasName()
{
var user = _userFaker.Generate();
Assert.NotEmpty(user.Name);
}
}NUnit and MSTest wire identically - Bogus is framework-agnostic.
Anti-patterns
| Anti-pattern | Why it fails | Fix |
|---|---|---|
RuleFor for some properties only, no StrictMode | New property added; factory silently leaves it default; tests pass against unrealistic state. | Always StrictMode(true). |
Same Faker<T> instance shared across parallel tests | xUnit runs collections in parallel; shared faker = race condition; flaky failures. | Construct per-test (new Faker<T>) or annotate with [Collection("NoParallel")]. |
Hard-coded UseSeed(42) in every factory | Same data in every test = N tests assert against the same name; coincidental passes. | Per-test seed or per-collection seed; document the convention. |
Generate(10000) in unit tests | Slow; CI cost adds up. | Use GenerateLazy(10000) or seed the DB via raw SQL bulk insert. |
Inline new Faker() for every property | The same generator can't share state across properties; randomized values mismatch. | One Faker<T> builder per entity; chain RuleFor calls. |
Limitations
References
FactoryBot (Ruby) - full workflow
View source (opens in new window)FactoryBot (Ruby) - full workflow
Reference detail for synthetic-data-toolkit (opens in new window). FactoryBot (formerly factory_girl) is the canonical Ruby fixture-factory library - it builds object graphs with referential integrity that raw faker-data cannot (factory_bot-readme (opens in new window)).
The split:
When to use
How to use
Install
gem install factory_botFor Rails projects, prefer the Rails-specific gem with auto-loading:
# Gemfile
group :test do
gem 'factory_bot_rails' # adds Rails-specific helpers and auto-loads spec/factories/
end(Per factory_bot-readme (opens in new window).)
Authoring
Basic factory
# spec/factories/users.rb
FactoryBot.define do
factory :user do
name { "John Doe" }
email { "john@example.com" }
end
end(Per factory_bot-readme (opens in new window).)
Each attribute is a block - the block is evaluated lazily at object creation, so Faker::Name.name re-runs per create call.
Sequences
For unique values across factory invocations:
sequence :email do |n|
"user#{n}@example.com"
end
factory :user do
email # uses the sequence
end(Per factory_bot-readme (opens in new window).)
Associations
factory :post do
title { "Hello" }
body { "World" }
user # implicit reference to a user factory
end
# OR explicit association
factory :post do
user # short form
# association :user, factory: :admin # explicit form
end
# Has-many: build N posts from a user factory
factory :user do
name { "John" }
after(:create) do |user|
create_list(:post, 3, user: user)
end
endTraits
Traits compose mix-ins onto a base factory:
factory :user do
name { "John Doe" }
email { "john@example.com" }
trait :admin do
role { "admin" }
end
trait :with_posts do
after(:create) do |user|
create_list(:post, 3, user: user)
end
end
end
# Apply one or more traits at create time
FactoryBot.create(:user, :admin, :with_posts)(Per factory_bot-readme (opens in new window).)
Traits are the canonical way to keep factory bodies DRY - instead of ten variant factories (:admin_user, :premium_user, :admin_premium_user, …), one base factory plus N traits composes to all variants.
Build strategies
Per factory_bot-readme (opens in new window), FactoryBot supports three:
| Strategy | What it does | When to use |
|---|---|---|
build(:x) | Returns an unsaved ActiveRecord object. | Pure-logic tests; no DB persistence needed. |
create(:x) | Saves the object (and any associations) to the database. | Integration tests that exercise persistence. |
build_stubbed(:x) | Returns a stubbed object: appears persisted (new_record? returns false) but never hits the database. | Speed up unit tests that don't actually need DB IO. |
Speed hierarchy: build_stubbed >> build >> create. Use the weakest one that still tests what you need.
build(:user) # Unsaved User instance
create(:user) # Persisted User (and any associations)
build_stubbed(:user) # Fake-persisted User; `id` is set, `new_record?` is falseIntegrating with Faker
Plug Faker into the factory body for randomized values:
require 'faker'
FactoryBot.define do
factory :user do
name { Faker::Name.name }
email { Faker::Internet.unique.email } # `.unique` enforces uniqueness across factory invocations
age { Faker::Number.between(from: 18, to: 80) }
end
endFaker::Internet.unique (and other unique helpers) tracks generated values per session and raises if exhausted. Use this instead of a sequence when you want both randomness and uniqueness.
Test framework integration
RSpec
# spec/spec_helper.rb (or rails_helper.rb for Rails)
RSpec.configure do |config|
config.include FactoryBot::Syntax::Methods # enables `create(:user)` instead of `FactoryBot.create(:user)`
end
# spec/users_spec.rb
RSpec.describe User do
it 'has a name' do
user = create(:user)
expect(user.name).to be_present
end
endMinitest
# test/test_helper.rb
class ActiveSupport::TestCase
include FactoryBot::Syntax::Methods
endPer factory_bot-readme (opens in new window); both syntaxes mirror the same DSL - only the test-framework hookup differs.
Worked example
A test needs an admin user that owns three posts. Define the factory with two traits and Faker-backed values:
# spec/factories/users.rb
FactoryBot.define do
factory :user do
name { Faker::Name.name }
email { Faker::Internet.unique.email }
trait :admin do
role { "admin" }
end
trait :with_posts do
after(:create) { |user| create_list(:post, 3, user: user) }
end
end
endCompose both traits in one intent-revealing call:
RSpec.describe User do
it 'admin owns three posts' do
user = create(:user, :admin, :with_posts)
expect(user.role).to eq('admin')
expect(user.posts.count).to eq(3)
end
endcreate persists the user and, via the :with_posts after(:create) hook, its three posts - one line instead of six lines of manual setup.
Anti-patterns
| Anti-pattern | Why it fails | Fix |
|---|---|---|
FactoryBot.create(:user) in every test, even for read-only assertions | Database overhead per test; suite slows linearly with test count. | Use build_stubbed for unit tests that don't exercise persistence; reserve create for integration tests. |
| One mega-factory with 30 attributes in the base | Every create(:user) writes 30 columns; tests that need 3 attributes pay the cost. | Minimal base factory + traits for the rich variants. |
| Per-test-class factory definitions | Two test files re-define :user differently; subtle bug. | One factory per class, in spec/factories/ (auto-loaded by factory_bot_rails). |
sequence for fields that should be random (e.g. names) | Sequence values are predictable; tests pass on User 1 User 2 patterns that wouldn't pass on real names. | Use Faker for value variety, sequence for uniqueness only. |
create_list(:user, 100) per test | DB write storm; even fast tests stall on bulk insert. | Use build_stubbed_list if persistence isn't required; if it is, use raw SQL bulk insert. |
| Factory associations that always create the parent | A test of Post creates a User; that creates 5 Permissions; etc. - explosion of objects. | Pass an existing parent: create(:post, user: existing_user). |
Limitations
References
Same fixture across four languages, plus per-test reset
View source (opens in new window)Same fixture across four languages, plus per-test reset
Generate a single user with name + email + a date of birth in [1980, 2000]. The pattern is identical across libraries; only the API style differs (method calls vs. RuleFor builders). The Python (Faker) canonical version is inline in SKILL.md.
Python (mimesis)
from mimesis import Generic, Locale
g = Generic(Locale.EN, seed=42)
user = {
"name": g.person.full_name(),
"email": g.person.email(),
"dob": g.datetime.date(start=1980, end=2000),
}JS / TS (faker-js)
import { faker } from '@faker-js/faker';
faker.seed(42);
const user = {
name: faker.person.fullName(),
email: faker.internet.email(),
dob: faker.date.birthdate({ min: 23, max: 43, mode: 'age' }),
};Ruby (FactoryBot + Faker)
FactoryBot.define do
factory :user do
name { Faker::Name.name }
email { Faker::Internet.unique.email }
dob { Faker::Date.birthday(min_age: 23, max_age: 43) }
end
end
# Use:
Faker::Config.random = Random.new(42)
user = FactoryBot.create(:user).NET (Bogus)
var faker = new Faker<User>("en")
.UseSeed(42)
.RuleFor(u => u.Name, f => f.Name.FullName())
.RuleFor(u => u.Email, f => f.Internet.Email())
.RuleFor(u => u.Dob, f => f.Date.Past(43));
var user = faker.Generate();Per-test resetting
Reset the seed in beforeEach (Vitest / Jest / pytest / RSpec) so each test starts with the same baseline:
import { faker } from '@faker-js/faker';
beforeEach(() => { faker.seed(42); });@pytest.fixture(autouse=True)
def reset_faker():
Faker.seed(42)RSpec.configure do |c|
c.before(:each) do
Faker::Config.random = Random.new(42)
end
end// xUnit fixture or per-test setup
[Fact]
public void Test()
{
var faker = new Faker<User>().UseSeed(42)...;
}Mimesis (Python) - full workflow
View source (opens in new window)Mimesis (Python) - full workflow
Reference detail for synthetic-data-toolkit (opens in new window). Mimesis is a Python test-data generator that's "widely recognized as the fastest data generator among Python solutions" with full type hints for editor autocompletion (mimesis-readme (opens in new window)).
The library supports 46 locales (mimesis-readme (opens in new window)) and exposes both per-provider methods (Person.full_name()) and a schema-based generator for typed-dict shapes.
When to use
If the team is already standardized on Faker, switching is rarely worth it - see faker-data. If the team needs factory orchestration with referential integrity, pair mimesis with factory_boy (or use FactoryBot - see factory-bot.md (opens in new window) - in Ruby projects).
Install
pip install mimesis(Per mimesis-readme (opens in new window).)
Authoring
Per-provider usage
from mimesis import Person, Address, Internet, Datetime
from mimesis.locales import Locale
person = Person(Locale.EN)
person.full_name() # 'Brande Sears'
person.email(domains=['example.com']) # 'roccelline1878@example.com'
person.gender()
person.title()
address = Address(Locale.EN)
address.full_address() # '123 Main St, Springfield, IL 62701'
address.city()
address.country()
internet = Internet()
internet.url()
internet.ip_v4()
internet.user_agent()
dt = Datetime()
dt.datetime()
dt.date()
dt.formatted_datetime()(Adapted from mimesis-readme (opens in new window).)
Generic - one entry point per locale
from mimesis import Generic
from mimesis.locales import Locale
g = Generic(Locale.EN)
g.person.full_name()
g.address.city()
g.internet.email()Generic aggregates every provider under one instance - preferred when a fixture needs values from multiple providers; avoids constructing one provider per type.
Schema-based - typed-dict generation
from mimesis import Field, Schema, Locale
field = Field(Locale.EN)
# Build one row's worth of data
def schema():
return {
"id": field("uuid"),
"name": field("person.full_name"),
"email": field("person.email"),
"created_at": field("datetime.datetime"),
"address": {
"city": field("address.city"),
"zip": field("address.postal_code"),
},
}
# Generate a list of rows
generator = Schema(schema=schema, iterations=1000)
data = generator.create() # → list of 1000 dicts(Adapted from mimesis-readme (opens in new window) schema documentation.)
The schema/field pattern is mimesis's distinguishing feature - it produces typed-dict shapes without per-field method calls, which makes it convenient for bulk fixture generation (e.g. seeding a test DB with 10k rows).
Locale support
from mimesis import Person
from mimesis.locales import Locale
Person(Locale.EN).full_name() # 'Brande Sears'
Person(Locale.JA).full_name() # '広橋 美月'
Person(Locale.RU).full_name() # 'Анастасия Иванова'
Person(Locale.DE).full_name() # 'Klaus Müller'Per mimesis-readme (opens in new window), 46 locales are supported. Full list at mimesis.name/latest/locales.html (opens in new window).
Seeding for determinism
from mimesis import Generic
from mimesis.locales import Locale
g = Generic(Locale.EN, seed=12345)
g.person.full_name() # deterministic based on seedPass seed= at provider construction; subsequent calls are deterministic. Same as faker-data, seed in tests so failures reproduce locally.
Pairing with factory_boy
Mimesis can be the value engine for factory_boy:
from factory import Factory, LazyFunction
from mimesis import Person, Locale
from myapp.models import User
person = Person(Locale.EN, seed=42)
class UserFactory(Factory):
class Meta:
model = User
name = LazyFunction(person.full_name)
email = LazyFunction(lambda: person.email())LazyFunction ensures each factory instantiation re-calls the mimesis method - getting a new value per fixture, not a single shared one.
Anti-patterns
| Anti-pattern | Why it fails | Fix |
|---|---|---|
| Constructing one provider per attribute | Person() per field is N times the constructor cost; slows bulk generation. | Use Generic once; access providers as attributes. |
Hardcoding seed= literally to a value the test depends on | Brittle: a mimesis update changes the PRNG sequence; the test fails next upgrade. | Pin mimesis version; OR assert patterns (matches a regex), not literal values. |
| Using mimesis for security payloads | Mimesis generates realistic-looking data; SQL injection / XSS won't appear. | Use malicious-payload-bank. |
| Schema with 100k iterations in pytest | Memory-bound; slow. | Generate to disk (Schema.to_csv, Schema.to_json) and seed the DB outside the test. |
| Mixing mimesis + Faker in the same project | Two PRNGs to seed; two doc surfaces; two upgrade cadences. | Pick one; if migrating, do it in a single PR. |
Limitations
References
Related skills
boundary-value-generator
Generates boundary-value test cases from typed input specifications - for each input field, produces the canonical 6-point set (one below, at, and above the lower bound; one below, at, and above the upper bound) plus equivalence-class representatives. Emits cases as parameterized test inputs (pytest @parametrize / Jest test.each / xUnit InlineData / etc.). Use when a function or endpoint has numeric / string-length / collection-size constraints and the team needs systematic edge-case coverage.
faker-data
Fixes test data that breaks tests - factory values in a shape the code under test rejects (a phone number that is not E.164), fixtures that only pass when the whole suite runs in order, and random values that make an assertion pass or fail depending on the run. Authors test-data factories with Faker: the Python `faker` library, the `@faker-js/faker` JS port, and the `faker-ruby` gem - install per language, the provider catalogue (person / internet / location / date / finance / lorem), locale selection and multi-locale mode, and seed-based determinism for reproducible runs. Scope is generating fresh values for tests that start from nothing, not replacing values inside a dataset that already holds real records - that goes to pii-masking-pipeline-builder. Use when fixtures need realistic values, a stable shape, or a fixed seed.
golden-file-conventions
Reference catalog for snapshot / golden file management - naming conventions, directory layout, when to add / update / remove a baseline, sanitization (timestamps, IDs, PII), per-OS / per-runtime variant strategy, and review workflow for snapshot diffs in PRs. Use when designing a snapshot-testing convention or auditing an existing one for drift.
malicious-payload-bank
Reference catalog of curated adversarial input payloads keyed by attack class - SQL injection, XSS, SSRF, path traversal, command injection, XXE, prototype pollution, regex DoS, Unicode confusables, header injection - plus per-context guidance for which payloads apply (URL parameter / form input / JSON body / file upload). Use when authoring negative-test cases for input validation, fuzz targets, or a security-focused test suite that needs to exercise the OWASP Top 10 attack surface.
msw-handlers
Authors Mock Service Worker (MSW) request handlers for both browser and Node.js test environments using the `http.get` / `http.post` / `HttpResponse.json` API, wires them via `setupWorker` (browser) or `setupServer` (Node), and manages the test lifecycle (`server.listen` / `resetHandlers` / `close`). Use when the project uses JavaScript / TypeScript and needs to mock fetch / XHR at the network layer for both Vitest / Jest unit tests and Cypress / Playwright integration tests.
negative-test-generator
Covers the refusal paths a handler already implements but nothing tests - a batch endpoint that must apply all rows or none, optimistic-concurrency version conflicts between two editors, or a delete that deliberately separates who you are from what you may do from the state the record is in. For each happy-path test, produces companions exercising input validation rejection, missing required fields, type mismatches, authorization failures, rate-limit errors, and adversarial payloads from the malicious-payload-bank, emitted as parameterized tests in the project's runner format. Use when code has deliberate error paths and the suite only proves the success case.
pairwise-test-case-generator
Generates parameterized test inputs combining boundary-value, equivalence-class, and pairwise-combinatorial cases from a typed multi-input specification - produces the cross-product of cases up to a configurable strength (1-wise / 2-wise / N-wise) using all-pairs reduction so the test surface stays tractable. Emits cases in the project's test-runner-native parametrize format. Use when a function or endpoint takes 3+ inputs whose interactions matter and full Cartesian product would explode.
seed-data-curator
Builds a reproducible E2E seed dataset for the project's test environments - picks a representative user / org / data-product cross-section, generates the rows via the project's chosen factory library (FactoryBot / mimesis / Bogus / Faker + factory_boy), persists the dataset as a checked-in fixture (SQL dump / JSON / per-engine seed file), and wires it into the test bootstrap. Use when starting E2E coverage on a project that has no seed strategy, or when an existing seed has drifted.
synthetic-pii-generator
Generates realistic-but-fake personally identifiable information (PII) - emails, phone numbers, SSNs / national IDs, addresses, names, credit-card numbers (test BIN ranges), date-of-birth - for non-production environments. Wraps Faker / mimesis with PII-aware constraints so generated values match real format expectations (Luhn-valid card numbers, region-valid phone formats, ITIN/SSN format) without ever generating real-person data. Use when seeding test environments, building demo data, or replacing real PII in copied datasets.
test-data-patterns
Pure reference catalog of the cross-language object-construction patterns for test data - Test Data Builder (Pryce/Freeman), Factory (with traits and associations), Object Mother, Fixture composition (per-test / per-describe / shared), Snapshot (defers to `golden-file-conventions` for the operational details), and Production-Data Anonymisation. Distinct from the per-language tool skills (`faker-data` and the `synthetic-data-toolkit` umbrella covering FactoryBot / mimesis / Bogus) which document tool-specific configuration; this catalog is the architecture-tier reference for choosing **which pattern** before reaching for the tool. Use when choosing a test-data construction pattern for a new suite, or auditing an existing suite whose fixtures have drifted into shared mutable state.
wiremock-stubs
Authors WireMock stub mappings for HTTP service mocking - `stubFor` with verb/path/header matchers + `willReturn` response shaping, lifecycle via `WireMockServer` (start / stop) or JUnit `WireMockExtension`, request verification via `verify()`, and dynamic-port allocation for parallel tests. Also carries the Mountebank multi-protocol workflow (TCP / SMTP / LDAP / gRPC imposters, record-playback proxying) in references/mountebank.md. Use when the project is JVM-based and tests need to mock HTTP dependencies (third-party APIs, internal microservices) at the network layer, or when mocking must go beyond HTTP.